Security is one of the prime concerns in internet applications these days. SSL is the most common means of securing communication. For Authentication, SSL and almost all other protocols use Digital Certificates or UserId/Passwords. Other Authentication means include Biometrics etc. Normally, in e-business related applications, the server is authenticated using a Certificate signed by a Certifying Authority. The authentication of the client is mostly dependent on the application. Sometimes it is done via UserId Password, sometimes via Digital Certificates or maybe not done at all.
The authentication, however, is singular and static. There is no means to dynamically authenticate the user. The problem is described in more detail below.
In SSL (Secure Socket Layer), the client needs to have a certificate signed by a Certificate Authority which is listed as trusted in the Servers Trusted Database. This enables it to access the application depending upon the access allowed to the user identified from the certificate. Now often, it is desirable that a user acts as two roles. A typical example would be a manager acting on behalf of his employee who may be on leave etc. In such cases, the server will not accept another certificate unless the session is broken and a new one established. Practically, speaking this means closing the browser or the application or wait for sometime for the timeout.
In SET (Secure Electronic Transaction), the client needs a Digital Credit Card i.e. special Digital Certificate with users' Credit Card information to buy things online. Now, he might wish to use one card for some items while use another card for the other items.
In SET, from the Merchant point of view also, he might wish to offer some certificate to a group of clients and some to other. That is to say, if the client wishes to buy high valued items, the server wishes to present Certificate-A and if the client is buying low priced items, he wishes to present Certificate-B. A typical example would be a merchant who wishes to place his money from Diamond items in one bank and the rest in another. Another example would be a number of merchants selling stuff from a single mall/store. They would like to present their own certificates during payment on the SET protocol.
In Secure Email applications, the client authenticates himself/herself using the Email Certificate i.e. a special Digital Certificate with users' email information. With internet users having more than one email IDs, the requirement to change their Email preferences is all the more relevant even in case of personal desktop. Users may wish to send some mails using their official ID and others using their personal ones (hotmail etc).
In Secure Email applications, if the desktop is shared between users, the next user will have to close and open the application to view his mail i.e. to change the certificate. The equivalent of ‘Switch ID’ in Notes is not available.
Another major problem comes in applications that are providing all the above. They have some applications that require normal authentication using Digital Certificates. Simultaneously, they might also have a store where users can buy using SET certificates. He might also provide his users with the Secure Mail option. Now each of these would require a different type of X509 Certificate or a combined Certificate with all the 3 extensions.
The problem with 3 different certificates has been discussed above, i.e the user needs to timeout or restart the session to use a different service.
The combined Certificate solves the problem to some extent. However, there are some disadvantages.
1. If a new application is to be added, the certificates need to be reissued and retyped. Example would be: A site implements a SET based store and the client get SET Certificates from CAs, however after some time the site also provides a Secure Email facility. in that case, the users need to have a combined certificate. SO they have to get a new certificate. The certificates being issued by the CA also need to be reformatted to have an additional field related to E-mails. This would lead to number of services increase, with different versions and types of certificates with the clients and the permutations and combinations of fields the CA would have to take care.
2. Combined Certificates also suffer from the disadvantage of disclosing the entire information of the user to the server, even if it is not required. For example, if a site only implements Secure Email, the user with a combined certificate will still send him all the information including the SET Details (Credit information) which is a security risk.